CWE-453: Insecure Default Variable Initialization
Filter
The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
What the weakness is: CWE-453 at MITRE. All weaknesses
Ask an AI about CWE-453
Show the prompt
Explain CWE-453: Insecure Default Variable Initialization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/453.html and https://cve.bz/cve/cwe/453?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.5CVE-2026-103577EPSS 0.6%
Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.
- 2.1CVE-2026-109828EPSS 0.3%
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote …
- 9.3CVE-2026-92950EPSS 0.2%
vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename…
- 2.1CVE-2026-19212EPSS 0.5%
A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument m_offsetType c…
- 10.0CVE-2026-0082EPSS 0.2%
In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges ne…
- 2.0CVE-2026-41330EPSS 0.1%
OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to properly enforce proxy, TLS, Docker, and Git TLS controls. Attackers can bypass security controls by overriding environment…
- 4.6CVE-2025-61926EPSS 0.5%
Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used fo…
- 7.8CVE-2025-48563EPSS 0.09%
In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction …
- 9.8CVE-2025-47945EPSS 0.7%
Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the signing secret has a weak default value. While the responsibility is left to the sys…
- 9.8CVE-2025-30206EPSS 0.9%
Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and comprom…
- 8.1CVE-2024-49120EPSS 1.1%
Windows Remote Desktop Services Remote Code Execution Vulnerability
- 7.5CVE-2024-41255EPSS 0.3%
filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.
- 6.4CVE-2024-39916EPSS 0.3%
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports generated by the installer that allows an attacker to modify files outside the export …
- 8.8CVE-2024-21411EPSS 2.6%
Skype for Consumer Remote Code Execution Vulnerability
- 7.8CVE-2023-27516EPSS 0.5%
An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to…
- 5.4CVE-2022-47197EPSS 1.0%
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escala…
- 5.4CVE-2022-47196EPSS 0.7%
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escala…
- 5.4CVE-2022-47195EPSS 0.7%
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escala…
- 5.4CVE-2022-47194EPSS 0.8%
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escala…
- 4.9CVE-2022-46831EPSS 0.5%
In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources normally limited to TeamCity system administrators.
- 8.1CVE-2022-3262EPSS 0.8%
A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an attacker to supply an incorrect name with the DNS search policy, affecting confid…
- 9.8CVE-2021-27426EPSS 1.2%
GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user.